coturn allocates a full per-peer SSL/session before verifying the DTLS cookie, enabling source-spoofing/botnet state-exhaustion DoS

Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

Coturn has unsafe nonce and relay port randomization due to weak random number generation.

Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)

Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection

Coturn: SQL Injection in HTTPS Admin Panel Delete Operations

Coturn: Format String Injection via TURN USERNAME/REALM into hiredis Redis Command

The coturn server can end in a state where it does not accept more requests with "even-port" enabled.

Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover